將所有參數編碼後組合成 GET 請求,適合 API 串接或非表單場景:
const PAYPAL_URL = 'https://www.sandbox.paypal.com/'; // 正式環境改 www.paypal.com
$paypalData = [
'cmd' => '_ext-enter',
'redirect_cmd' => '_xclick',
'business' => 'merchant@example.com',
'item_name' => 'MyShop Order',
'item_number' => $order->id,
'amount' => $order->subtotal,
'shipping' => $order->shipping_fee,
'currency_code' => 'USD',
'first_name' => $address->first_name,
'last_name' => $address->last_name,
'address1' => $address->address1,
'city' => $address->city,
'state' => $address->state_or_province,
'zip' => $address->zip_code,
'no_note' => 1,
'lc' => 'US',
];
$params = [];
foreach ($paypalData as $k => $v) $params[] = "$k=" . urlencode($v);
$paypalUrl = PAYPAL_URL . '?' . implode('&', $params);
header("Location: $paypalUrl");
exit;
同前文:cmd=_notify-validate 原樣 POST 回 PayPal → 判斷 VERIFIED → 四檢(Completed、txn_id 唯一、receiver_email 正確、金額幣別匹配)→ 更新訂單。
| 場景 | 表單 POST | URL 導向 (GET) |
|---|---|---|
| 參數長度限制 | 無實質限制 | 受瀏覽器/伺服器 URL 長度限制 (~2KB) |
| 敏感資料暴露 | Body 中,較不易見 | URL 完整顯示於地址列、伺服器日誌 |
| 適用場景 | 標準網頁結帳 | API 串接、AJAX 取得導向連結、行動裝置 |
PAYPAL_URL 改為 https://www.paypal.com/business 改為正式商家 Email